chore: bump version to 0.7.3

* feat: resolve .numa services to LAN IP for remote clients

Remote DNS clients (e.g. phones on same WiFi) received 127.0.0.1 for
local .numa services, which is unreachable from their perspective.
Now returns the host's LAN IP when the query originates from a
non-loopback address. Also auto-widens proxy bind to 0.0.0.0 when
DNS is already public, and adds a startup warning when the proxy
remains localhost-only.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: respect proxy bind_addr config, don't auto-widen

The auto-widen silently overrode an explicit config value — the user's
config should be the source of truth. Now the proxy always uses the
configured bind_addr, and the warning fires whenever it's 127.0.0.1.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs: update proxy bind_addr comment in example config

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Cargo.lock

@@ -1143,7 +1143,7 @@ dependencies = [
 
 [[package]]
 name = "numa"
-version = "0.7.1"
+version = "0.7.3"
 dependencies = [
  "arc-swap",
  "axum",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "numa"
-version = "0.7.1"
+version = "0.7.3"
 authors = ["razvandimescu <razvan@dimescu.com>"]
 edition = "2021"
 description = "Portable DNS resolver in Rust — .numa local domains, ad blocking, developer overrides, DNS-over-HTTPS"

README.md

@@ -8,189 +8,93 @@
 
 A portable DNS resolver in a single binary. Block ads on any network, name your local services (`frontend.numa`), and override any hostname with auto-revert — all from your laptop, no cloud account or Raspberry Pi required.
 
-Built from scratch in Rust. Zero DNS libraries. RFC 1035 wire protocol parsed by hand. Recursive resolution from root nameservers with full DNSSEC validation (chain-of-trust + NSEC/NSEC3 denial proofs). One ~8MB binary, no PHP, no web server, no database — everything is embedded.
+Built from scratch in Rust. Zero DNS libraries. RFC 1035 wire protocol parsed by hand. Recursive resolution from root nameservers with full DNSSEC chain-of-trust validation. One ~8MB binary, everything embedded.
 
 ![Numa dashboard](assets/hero-demo.gif)
 
 ## Quick Start
 
 ```bash
-# Install (pick one)
-brew install razvandimescu/tap/numa
-cargo install numa
-curl -fsSL https://raw.githubusercontent.com/razvandimescu/numa/main/install.sh | sh
-
-# Run (port 53 requires root)
-sudo numa
-
-# Try it
-dig @127.0.0.1 google.com           # ✓ resolves normally
-dig @127.0.0.1 ads.google.com       # ✗ blocked → 0.0.0.0
+brew install razvandimescu/tap/numa    # or: cargo install numa
+sudo numa                              # port 53 requires root
 ```
 
 Open the dashboard: **http://numa.numa** (or `http://localhost:5380`)
 
-### Set as system resolver
+Set as system DNS: `sudo numa install && sudo numa service start`
 
-```bash
-# Point your system DNS to Numa (saves originals for uninstall)
-sudo numa install
+## Local Services
 
-# Run as a persistent service (auto-starts on boot, restarts if killed)
-sudo numa service start
-```
-
-To uninstall: `sudo numa service stop` removes the service, `sudo numa uninstall` restores your original DNS.
-
-### Upgrade
-
-```bash
-# From Homebrew
-brew upgrade numa
-
-# From source
-make deploy    # builds release, copies binary, re-signs, restarts service
-```
-
-### Build from source
-
-```bash
-git clone https://github.com/razvandimescu/numa.git && cd numa
-cargo build --release
-sudo cp target/release/numa /usr/local/bin/numa
-```
-
-## Why Numa
-
-- **Local service proxy** — `https://frontend.numa` instead of `localhost:5173`. Auto-generated TLS certs, WebSocket support for HMR. Like `/etc/hosts` but with auto TLS, a REST API, LAN discovery, and auto-revert.
-- **Path-based routing** — `app.numa/api → :5001`, `app.numa/auth → :5002`. Route URL paths to different backends with optional prefix stripping. Like nginx location blocks, zero config files.
-- **LAN service discovery** — Numa instances on the same network find each other automatically via mDNS. Access a teammate's `api.numa` from your machine. Opt-in via `[lan] enabled = true`.
-- **Developer overrides** — point any hostname to any IP, auto-reverts after N minutes. Full REST API for scripting. Built-in diagnostics: `curl localhost:5380/diagnose/example.com` tells you exactly how any domain resolves.
-- **DNS-over-HTTPS** — upstream queries encrypted via DoH. Your ISP sees HTTPS traffic, not DNS queries. Set `address = "https://9.9.9.9/dns-query"` in `[upstream]` or any DoH provider.
-- **Ad blocking that travels with you** — 385K+ domains blocked via [Hagezi Pro](https://github.com/hagezi/dns-blocklists). Works on any network: coffee shops, hotels, airports.
-- **Sub-microsecond caching** — 691ns cached round-trip, ~2.0M queries/sec throughput, zero heap allocations in the I/O path. [Benchmarks](bench/).
-- **Live dashboard** — real-time stats, query log, blocking controls, service management. LAN accessibility badges show which services are reachable from other devices.
-- **macOS, Linux, and Windows** — `numa install` configures system DNS, `numa service start` runs as launchd/systemd service.
-
-## Local Service Proxy
-
-Name your local dev services with `.numa` domains:
+Name your dev services instead of remembering port numbers:
 
 ```bash
 curl -X POST localhost:5380/services \
-  -H 'Content-Type: application/json' \
   -d '{"name":"frontend","target_port":5173}'
-
-open http://frontend.numa            # → proxied to localhost:5173
 ```
 
-- **HTTPS with green lock** — auto-generated local CA + per-service TLS certs
-- **WebSocket** — Vite/webpack HMR works through the proxy
-- **Health checks** — dashboard shows green/red status per service
-- **LAN sharing** — services bound to `0.0.0.0` are automatically discoverable by other Numa instances on the network. Dashboard shows "LAN" or "local only" per service.
-- **Path-based routing** — route URL paths to different backends:
-  ```toml
-  [[services]]
-  name = "app"
-  target_port = 3000
-  routes = [
-      { path = "/api", port = 5001 },
-      { path = "/auth", port = 5002, strip = true },
-  ]
-  ```
-  `app.numa/api/users → :5001/api/users`, `app.numa/auth/login → :5002/login` (stripped)
-- **Persistent** — services survive restarts
-- Or configure in `numa.toml`:
+Now `https://frontend.numa` works in your browser — green lock, valid cert, WebSocket passthrough for HMR. No mkcert, no nginx, no `/etc/hosts`.
 
-```toml
-[[services]]
-name = "frontend"
-target_port = 5173
-```
+Add path-based routing (`app.numa/api → :5001`), share services across machines via LAN discovery, or configure everything in [`numa.toml`](numa.toml).
 
-## LAN Service Discovery
+## Ad Blocking & Privacy
 
-Run Numa on multiple machines. They find each other automatically:
+385K+ domains blocked via [Hagezi Pro](https://github.com/hagezi/dns-blocklists). Works on any network — coffee shops, hotels, airports. Travels with your laptop.
+
+Two resolution modes: **forward** (relay to Quad9/Cloudflare via encrypted DoH) or **recursive** (resolve from root nameservers — no upstream dependency, no single entity sees your full query pattern). DNSSEC validates the full chain of trust: RRSIG signatures, DNSKEY verification, DS delegation, NSEC/NSEC3 denial proofs. [Read how it works →](https://numa.rs/blog/posts/dnssec-from-scratch.html)
+
+## LAN Discovery
+
+Run Numa on multiple machines. They find each other automatically via mDNS:
 
 ```
 Machine A (192.168.1.5)              Machine B (192.168.1.20)
 ┌──────────────────────┐             ┌──────────────────────┐
 │ Numa                 │    mDNS     │ Numa                 │
-│  services:           │◄───────────►│  services:           │
-│   - api (port 8000)  │  discovery  │   - grafana (3000)   │
-│   - frontend (5173)  │             │                      │
+│  - api (port 8000)   │◄───────────►│  - grafana (3000)    │
+│  - frontend (5173)   │  discovery  │                      │
 └──────────────────────┘             └──────────────────────┘
 ```
 
-From Machine B:
-```bash
-dig @127.0.0.1 api.numa          # → 192.168.1.5
-curl http://api.numa              # → proxied to Machine A's port 8000
-```
+From Machine B: `curl http://api.numa` → proxied to Machine A's port 8000. Enable with `numa lan on`.
 
-Enable LAN discovery:
-```bash
-numa lan on
-```
-Or in `numa.toml`:
-```toml
-[lan]
-enabled = true
-```
-Uses standard mDNS (`_numa._tcp.local` on port 5353) — compatible with Bonjour/Avahi, silently dropped by corporate firewalls instead of triggering IPS alerts.
-
-**Hub mode** — don't want to install Numa on every machine? Run one instance as a shared DNS server and point other devices to it:
-
-```bash
-# On the hub machine, bind to LAN interface
-[server]
-bind_addr = "0.0.0.0:53"
-
-# On other devices, set DNS to the hub's IP
-# They get .numa resolution, ad blocking, caching — zero install
-```
+**Hub mode**: run one instance with `bind_addr = "0.0.0.0:53"` and point other devices' DNS to it — they get ad blocking + `.numa` resolution without installing anything.
 
 ## How It Compares
 
-| | Pi-hole | AdGuard Home | NextDNS | Cloudflare | Numa |
-|---|---|---|---|---|---|
-| Local service proxy | No | No | No | No | `.numa` + HTTPS + WS |
-| Path-based routing | No | No | No | No | Prefix match + strip |
-| LAN service discovery | No | No | No | No | mDNS, opt-in |
-| Developer overrides | No | No | No | No | REST API + auto-expiry |
-| Recursive resolver | No | No | Cloud only | Cloud only | From root hints, DNSSEC |
-| Encrypted upstream (DoH) | No (needs cloudflared) | Yes | Cloud only | Cloud only | Native, single binary |
-| Portable (travels with laptop) | No (appliance) | No (appliance) | Cloud only | Cloud only | Single binary |
-| Zero config | Complex | Docker/setup | Yes | Yes | Works out of the box |
-| Ad blocking | Yes | Yes | Yes | Limited | 385K+ domains |
-| Data stays local | Yes | Yes | Cloud | Cloud | 100% local |
+| | Pi-hole | AdGuard Home | Unbound | Numa |
+|---|---|---|---|---|
+| Local service proxy + auto TLS | — | — | — | `.numa` domains, HTTPS, WebSocket |
+| LAN service discovery | — | — | — | mDNS, zero config |
+| Developer overrides (REST API) | — | — | — | Auto-revert, scriptable |
+| Recursive resolver | — | — | Yes | Yes, with SRTT selection |
+| DNSSEC validation | — | — | Yes | Yes (RSA, ECDSA, Ed25519) |
+| Ad blocking | Yes | Yes | — | 385K+ domains |
+| Web admin UI | Full | Full | — | Dashboard |
+| Encrypted upstream (DoH) | Needs cloudflared | Yes | — | Native |
+| Portable (laptop) | No (appliance) | No (appliance) | Server | Single binary |
+| Community maturity | 56K stars, 10 years | 33K stars | 20 years | New |
 
-## How It Works
+## Performance
 
-```
-Query → Overrides → .numa TLD → Blocklist → Local Zones → Cache → Recursive/Forward
-```
+691ns cached round-trip. ~2.0M qps throughput. Zero heap allocations in the hot path. Recursive queries average 237ms after SRTT warmup (12x improvement over round-robin). ECDSA P-256 DNSSEC verification: 174ns. [Benchmarks →](bench/)
 
-Two resolution modes: **forward** (relay to upstream like Quad9/Cloudflare) or **recursive** (resolve from root nameservers — no upstream dependency). Set `mode = "recursive"` in `[upstream]` to resolve independently.
+## Learn More
 
-No DNS libraries — no `hickory-dns`, no `trust-dns`. The wire protocol — headers, labels, compression pointers, record types — is parsed and serialized by hand. Runs on `tokio` + `axum`, async per-query task spawning.
-
-[Configuration reference](numa.toml)
+- [Blog: Implementing DNSSEC from Scratch in Rust](https://numa.rs/blog/posts/dnssec-from-scratch.html)
+- [Blog: I Built a DNS Resolver from Scratch](https://numa.rs/blog/posts/dns-from-scratch.html)
+- [Configuration reference](numa.toml) — all options documented inline
+- [REST API](src/api.rs) — 27 endpoints across overrides, cache, blocking, services, diagnostics
 
 ## Roadmap
 
-- [x] DNS proxy core — forwarding, caching, local zones
-- [x] Developer overrides — REST API with auto-expiry
-- [x] Ad blocking — 385K+ domains, live dashboard, allowlist
-- [x] System integration — macOS + Linux, launchd/systemd, Tailscale/VPN auto-discovery
-- [x] Local service proxy — `.numa` domains, HTTP/HTTPS proxy, auto TLS, WebSocket
-- [x] Path-based routing — URL prefix routing with optional strip, REST API
-- [x] LAN service discovery — mDNS auto-discovery (opt-in), cross-machine DNS + proxy
-- [x] DNS-over-HTTPS — encrypted upstream via DoH (Quad9, Cloudflare, any provider)
-- [x] Recursive resolution — resolve from root nameservers, no upstream dependency
-- [x] DNSSEC validation — chain-of-trust, NSEC/NSEC3 denial proofs, AD bit (RSA, ECDSA, Ed25519)
-- [ ] pkarr integration — self-sovereign DNS via Mainline DHT (15M nodes)
-- [ ] Global `.numa` names — self-publish, DHT-backed, first-come-first-served
+- [x] DNS forwarding, caching, ad blocking, developer overrides
+- [x] `.numa` local domains — auto TLS, path routing, WebSocket proxy
+- [x] LAN service discovery — mDNS, cross-machine DNS + proxy
+- [x] DNS-over-HTTPS — encrypted upstream
+- [x] Recursive resolution + DNSSEC — chain-of-trust, NSEC/NSEC3
+- [x] SRTT-based nameserver selection
+- [ ] pkarr integration — self-sovereign DNS via Mainline DHT
+- [ ] Global `.numa` names — DHT-backed, no registrar
 
 ## License
 

numa.toml

@@ -54,7 +54,7 @@ enabled = true
 port = 80
 tls_port = 443
 tld = "numa"
-# bind_addr = "127.0.0.1"  # default; auto 0.0.0.0 when [lan] enabled
+# bind_addr = "127.0.0.1"  # default; set to "0.0.0.0" for LAN access to .numa services
 
 # Pre-configured services (numa.numa is always added automatically)
 # [[services]]

src/api.rs

@@ -410,14 +410,8 @@ async fn forward_query_for_diagnose(
     timeout: std::time::Duration,
 ) -> (bool, String) {
     use crate::packet::DnsPacket;
-    use crate::question::DnsQuestion;
 
-    let mut query = DnsPacket::new();
-    query.header.id = 0xBEEF;
-    query.header.recursion_desired = true;
-    query
-        .questions
-        .push(DnsQuestion::new(domain.to_string(), QueryType::A));
+    let query = DnsPacket::query(0xBEEF, domain, QueryType::A);
 
     match forward_query(&query, upstream, timeout).await {
         Ok(resp) => (

src/ctx.rs

@@ -93,18 +93,13 @@ pub async fn handle_query(
         } else if qname == "localhost" || qname.ends_with(".localhost") {
             // RFC 6761: .localhost always resolves to loopback
             let mut resp = DnsPacket::response_from(&query, ResultCode::NOERROR);
-            match qtype {
-                QueryType::AAAA => resp.answers.push(DnsRecord::AAAA {
-                    domain: qname.clone(),
-                    addr: std::net::Ipv6Addr::LOCALHOST,
-                    ttl: 300,
-                }),
-                _ => resp.answers.push(DnsRecord::A {
-                    domain: qname.clone(),
-                    addr: std::net::Ipv4Addr::LOCALHOST,
-                    ttl: 300,
-                }),
-            }
+            resp.answers.push(sinkhole_record(
+                &qname,
+                qtype,
+                std::net::Ipv4Addr::LOCALHOST,
+                std::net::Ipv6Addr::LOCALHOST,
+                300,
+            ));
             (resp, QueryPath::Local, DnssecStatus::Indeterminate)
         } else if is_special_use_domain(&qname) {
             // RFC 6761/8880: private PTR, DDR, NAT64 — answer locally
@@ -113,12 +108,17 @@ pub async fn handle_query(
         } else if !ctx.proxy_tld_suffix.is_empty()
             && (qname.ends_with(&ctx.proxy_tld_suffix) || qname == ctx.proxy_tld)
         {
-            // Resolve .numa: local services → 127.0.0.1, LAN peers → peer IP
+            // Resolve .numa: remote clients get LAN IP (can't reach 127.0.0.1), local get loopback
             let service_name = qname.strip_suffix(&ctx.proxy_tld_suffix).unwrap_or(&qname);
+            let is_remote = !src_addr.ip().is_loopback();
             let resolve_ip = {
                 let local = ctx.services.lock().unwrap();
                 if local.lookup(service_name).is_some() {
-                    std::net::Ipv4Addr::LOCALHOST
+                    if is_remote {
+                        *ctx.lan_ip.lock().unwrap()
+                    } else {
+                        std::net::Ipv4Addr::LOCALHOST
+                    }
                 } else {
                     let mut peers = ctx.lan_peers.lock().unwrap();
                     peers
@@ -130,38 +130,24 @@ pub async fn handle_query(
                         .unwrap_or(std::net::Ipv4Addr::LOCALHOST)
                 }
             };
+            let v6 = if resolve_ip == std::net::Ipv4Addr::LOCALHOST {
+                std::net::Ipv6Addr::LOCALHOST
+            } else {
+                resolve_ip.to_ipv6_mapped()
+            };
             let mut resp = DnsPacket::response_from(&query, ResultCode::NOERROR);
-            match qtype {
-                QueryType::AAAA => resp.answers.push(DnsRecord::AAAA {
-                    domain: qname.clone(),
-                    addr: if resolve_ip == std::net::Ipv4Addr::LOCALHOST {
-                        std::net::Ipv6Addr::LOCALHOST
-                    } else {
-                        resolve_ip.to_ipv6_mapped()
-                    },
-                    ttl: 300,
-                }),
-                _ => resp.answers.push(DnsRecord::A {
-                    domain: qname.clone(),
-                    addr: resolve_ip,
-                    ttl: 300,
-                }),
-            }
+            resp.answers
+                .push(sinkhole_record(&qname, qtype, resolve_ip, v6, 300));
             (resp, QueryPath::Local, DnssecStatus::Indeterminate)
         } else if ctx.blocklist.read().unwrap().is_blocked(&qname) {
             let mut resp = DnsPacket::response_from(&query, ResultCode::NOERROR);
-            match qtype {
-                QueryType::AAAA => resp.answers.push(DnsRecord::AAAA {
-                    domain: qname.clone(),
-                    addr: std::net::Ipv6Addr::UNSPECIFIED,
-                    ttl: 60,
-                }),
-                _ => resp.answers.push(DnsRecord::A {
-                    domain: qname.clone(),
-                    addr: std::net::Ipv4Addr::UNSPECIFIED,
-                    ttl: 60,
-                }),
-            }
+            resp.answers.push(sinkhole_record(
+                &qname,
+                qtype,
+                std::net::Ipv4Addr::UNSPECIFIED,
+                std::net::Ipv6Addr::UNSPECIFIED,
+                60,
+            ));
             (resp, QueryPath::Blocked, DnssecStatus::Indeterminate)
         } else if let Some(records) = ctx.zone_map.get(qname.as_str()).and_then(|m| m.get(&qtype)) {
             let mut resp = DnsPacket::response_from(&query, ResultCode::NOERROR);
@@ -178,62 +164,29 @@ pub async fn handle_query(
                 (resp, QueryPath::Cached, cached_dnssec)
             } else if ctx.upstream_mode == UpstreamMode::Recursive {
                 let key = (qname.clone(), qtype);
-                let disposition = acquire_inflight(&ctx.inflight, key.clone());
-
-                match disposition {
-                    Disposition::Follower(mut rx) => {
-                        debug!("{} | {:?} {} | COALESCED", src_addr, qtype, qname);
-                        match rx.recv().await {
-                            Ok(Some(mut resp)) => {
-                                resp.header.id = query.header.id;
-                                (resp, QueryPath::Coalesced, DnssecStatus::Indeterminate)
-                            }
-                            _ => (
-                                DnsPacket::response_from(&query, ResultCode::SERVFAIL),
-                                QueryPath::UpstreamError,
-                                DnssecStatus::Indeterminate,
-                            ),
-                        }
-                    }
-                    Disposition::Leader(tx) => {
-                        // Drop guard: remove inflight entry even on panic/cancellation
-                        let guard = InflightGuard {
-                            inflight: &ctx.inflight,
-                            key: key.clone(),
-                        };
-
-                        let result = crate::recursive::resolve_recursive(
-                            &qname,
-                            qtype,
-                            &ctx.cache,
-                            &query,
-                            &ctx.root_hints,
-                            &ctx.srtt,
-                        )
-                        .await;
-
-                        drop(guard);
-
-                        match result {
-                            Ok(resp) => {
-                                let _ = tx.send(Some(resp.clone()));
-                                (resp, QueryPath::Recursive, DnssecStatus::Indeterminate)
-                            }
-                            Err(e) => {
-                                let _ = tx.send(None);
-                                error!(
-                                    "{} | {:?} {} | RECURSIVE ERROR | {}",
-                                    src_addr, qtype, qname, e
-                                );
-                                (
-                                    DnsPacket::response_from(&query, ResultCode::SERVFAIL),
-                                    QueryPath::UpstreamError,
-                                    DnssecStatus::Indeterminate,
-                                )
-                            }
-                        }
-                    }
+                let (resp, path, err) = resolve_coalesced(&ctx.inflight, key, &query, || {
+                    crate::recursive::resolve_recursive(
+                        &qname,
+                        qtype,
+                        &ctx.cache,
+                        &query,
+                        &ctx.root_hints,
+                        &ctx.srtt,
+                    )
+                })
+                .await;
+                if path == QueryPath::Coalesced {
+                    debug!("{} | {:?} {} | COALESCED", src_addr, qtype, qname);
+                } else if path == QueryPath::UpstreamError {
+                    error!(
+                        "{} | {:?} {} | RECURSIVE ERROR | {}",
+                        src_addr,
+                        qtype,
+                        qname,
+                        err.as_deref().unwrap_or("leader failed")
+                    );
                 }
+                (resp, path, DnssecStatus::Indeterminate)
             } else {
                 let upstream =
                     match crate::system_dns::match_forwarding_rule(&qname, &ctx.forwarding_rules) {
@@ -416,6 +369,27 @@ fn is_special_use_domain(qname: &str) -> bool {
     qname == "local" || qname.ends_with(".local")
 }
 
+fn sinkhole_record(
+    domain: &str,
+    qtype: QueryType,
+    v4: std::net::Ipv4Addr,
+    v6: std::net::Ipv6Addr,
+    ttl: u32,
+) -> DnsRecord {
+    match qtype {
+        QueryType::AAAA => DnsRecord::AAAA {
+            domain: domain.to_string(),
+            addr: v6,
+            ttl,
+        },
+        _ => DnsRecord::A {
+            domain: domain.to_string(),
+            addr: v4,
+            ttl,
+        },
+    }
+}
+
 enum Disposition {
     Leader(broadcast::Sender<Option<DnsPacket>>),
     Follower(broadcast::Receiver<Option<DnsPacket>>),
@@ -432,6 +406,57 @@ fn acquire_inflight(inflight: &Mutex<InflightMap>, key: (String, QueryType)) ->
     }
 }
 
+/// Run a resolve function with in-flight coalescing. Multiple concurrent calls
+/// for the same key share a single resolution — the first caller (leader)
+/// executes `resolve_fn`, and followers wait for the broadcast result.
+async fn resolve_coalesced<F, Fut>(
+    inflight: &Mutex<InflightMap>,
+    key: (String, QueryType),
+    query: &DnsPacket,
+    resolve_fn: F,
+) -> (DnsPacket, QueryPath, Option<String>)
+where
+    F: FnOnce() -> Fut,
+    Fut: std::future::Future<Output = crate::Result<DnsPacket>>,
+{
+    let disposition = acquire_inflight(inflight, key.clone());
+
+    match disposition {
+        Disposition::Follower(mut rx) => match rx.recv().await {
+            Ok(Some(mut resp)) => {
+                resp.header.id = query.header.id;
+                (resp, QueryPath::Coalesced, None)
+            }
+            _ => (
+                DnsPacket::response_from(query, ResultCode::SERVFAIL),
+                QueryPath::UpstreamError,
+                None,
+            ),
+        },
+        Disposition::Leader(tx) => {
+            let guard = InflightGuard { inflight, key };
+            let result = resolve_fn().await;
+            drop(guard);
+
+            match result {
+                Ok(resp) => {
+                    let _ = tx.send(Some(resp.clone()));
+                    (resp, QueryPath::Recursive, None)
+                }
+                Err(e) => {
+                    let _ = tx.send(None);
+                    let err_msg = e.to_string();
+                    (
+                        DnsPacket::response_from(query, ResultCode::SERVFAIL),
+                        QueryPath::UpstreamError,
+                        Some(err_msg),
+                    )
+                }
+            }
+        }
+    }
+}
+
 struct InflightGuard<'a> {
     inflight: &'a Mutex<InflightMap>,
     key: (String, QueryType),
@@ -443,20 +468,6 @@ impl Drop for InflightGuard<'_> {
     }
 }
 
-/// Build a wire-format DNS query packet for the given domain and type.
-#[cfg(test)]
-fn build_wire_query(id: u16, domain: &str, qtype: QueryType) -> BytePacketBuffer {
-    let mut pkt = DnsPacket::new();
-    pkt.header.id = id;
-    pkt.header.recursion_desired = true;
-    pkt.header.questions = 1;
-    pkt.questions
-        .push(crate::question::DnsQuestion::new(domain.to_string(), qtype));
-    let mut buf = BytePacketBuffer::new();
-    pkt.write(&mut buf).unwrap();
-    BytePacketBuffer::from_bytes(buf.filled())
-}
-
 fn special_use_response(query: &DnsPacket, qname: &str, qtype: QueryType) -> DnsPacket {
     use std::net::{Ipv4Addr, Ipv6Addr};
     if qname == "ipv4only.arpa" {
@@ -495,8 +506,8 @@ fn special_use_response(query: &DnsPacket, qname: &str, qtype: QueryType) -> Dns
 mod tests {
     use super::*;
     use std::collections::HashMap;
-    use std::net::{Ipv4Addr, SocketAddr};
-    use std::sync::{Arc, Mutex, RwLock};
+    use std::net::Ipv4Addr;
+    use std::sync::{Arc, Mutex};
     use tokio::sync::broadcast;
 
     // ---- InflightGuard unit tests ----
@@ -669,189 +680,212 @@ mod tests {
         }
     }
 
-    // ---- Integration: concurrent handle_query coalescing ----
+    // ---- Integration: resolve_coalesced with mock futures ----
 
-    use tokio::io::{AsyncReadExt, AsyncWriteExt};
-    use tokio::net::TcpListener;
-
-    /// Spawn a slow TCP DNS server that delays `delay` before responding.
-    /// Returns (addr, query_count) where query_count is an Arc<AtomicU32>
-    /// tracking how many queries were actually resolved (not coalesced).
-    async fn spawn_slow_dns_server(
-        delay: Duration,
-    ) -> (SocketAddr, Arc<std::sync::atomic::AtomicU32>) {
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let addr = listener.local_addr().unwrap();
-        let count = Arc::new(std::sync::atomic::AtomicU32::new(0));
-        let count_clone = count.clone();
-
-        tokio::spawn(async move {
-            loop {
-                let (mut stream, _) = match listener.accept().await {
-                    Ok(c) => c,
-                    Err(_) => break,
-                };
-                let count = count_clone.clone();
-                let delay = delay;
-                tokio::spawn(async move {
-                    let mut len_buf = [0u8; 2];
-                    if stream.read_exact(&mut len_buf).await.is_err() {
-                        return;
-                    }
-                    let len = u16::from_be_bytes(len_buf) as usize;
-                    let mut data = vec![0u8; len];
-                    if stream.read_exact(&mut data).await.is_err() {
-                        return;
-                    }
-
-                    let mut buf = BytePacketBuffer::from_bytes(&data);
-                    let query = match DnsPacket::from_buffer(&mut buf) {
-                        Ok(q) => q,
-                        Err(_) => return,
-                    };
-
-                    count.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
-
-                    // Deliberate delay to create coalescing window
-                    tokio::time::sleep(delay).await;
-
-                    let mut resp = DnsPacket::response_from(&query, ResultCode::NOERROR);
-                    resp.header.authoritative_answer = true;
-                    if let Some(q) = query.questions.first() {
-                        resp.answers.push(DnsRecord::A {
-                            domain: q.name.clone(),
-                            addr: Ipv4Addr::new(10, 0, 0, 1),
-                            ttl: 300,
-                        });
-                    }
-
-                    let mut resp_buf = BytePacketBuffer::new();
-                    if resp.write(&mut resp_buf).is_err() {
-                        return;
-                    }
-                    let resp_bytes = resp_buf.filled();
-                    let mut out = Vec::with_capacity(2 + resp_bytes.len());
-                    out.extend_from_slice(&(resp_bytes.len() as u16).to_be_bytes());
-                    out.extend_from_slice(resp_bytes);
-                    let _ = stream.write_all(&out).await;
-                });
-            }
+    fn mock_response(domain: &str) -> DnsPacket {
+        let mut resp = DnsPacket::new();
+        resp.header.response = true;
+        resp.header.rescode = ResultCode::NOERROR;
+        resp.answers.push(DnsRecord::A {
+            domain: domain.to_string(),
+            addr: Ipv4Addr::new(10, 0, 0, 1),
+            ttl: 300,
         });
-        (addr, count)
-    }
-
-    async fn test_recursive_ctx(root_hint: SocketAddr) -> Arc<ServerCtx> {
-        let socket = tokio::net::UdpSocket::bind("127.0.0.1:0").await.unwrap();
-        Arc::new(ServerCtx {
-            socket,
-            zone_map: HashMap::new(),
-            cache: RwLock::new(crate::cache::DnsCache::new(100, 60, 86400)),
-            stats: Mutex::new(crate::stats::ServerStats::new()),
-            overrides: RwLock::new(crate::override_store::OverrideStore::new()),
-            blocklist: RwLock::new(crate::blocklist::BlocklistStore::new()),
-            query_log: Mutex::new(crate::query_log::QueryLog::new(100)),
-            services: Mutex::new(crate::service_store::ServiceStore::new()),
-            lan_peers: Mutex::new(crate::lan::PeerStore::new(90)),
-            forwarding_rules: Vec::new(),
-            upstream: Mutex::new(crate::forward::Upstream::Udp(
-                "127.0.0.1:53".parse().unwrap(),
-            )),
-            upstream_auto: false,
-            upstream_port: 53,
-            lan_ip: Mutex::new(Ipv4Addr::LOCALHOST),
-            timeout: Duration::from_secs(3),
-            proxy_tld: "numa".to_string(),
-            proxy_tld_suffix: ".numa".to_string(),
-            lan_enabled: false,
-            config_path: "/tmp/test-numa.toml".to_string(),
-            config_found: false,
-            config_dir: std::path::PathBuf::from("/tmp"),
-            data_dir: std::path::PathBuf::from("/tmp"),
-            tls_config: None,
-            upstream_mode: crate::config::UpstreamMode::Recursive,
-            root_hints: vec![root_hint],
-            srtt: RwLock::new(crate::srtt::SrttCache::new(true)),
-            inflight: Mutex::new(HashMap::new()),
-            dnssec_enabled: false,
-            dnssec_strict: false,
-        })
+        resp
     }
 
     #[tokio::test]
     async fn concurrent_queries_coalesce_to_single_resolution() {
-        // Force TCP-only so mock server works
-        crate::recursive::UDP_DISABLED.store(true, std::sync::atomic::Ordering::Release);
+        let inflight = Arc::new(Mutex::new(HashMap::new()));
+        let resolve_count = Arc::new(std::sync::atomic::AtomicU32::new(0));
 
-        let (server_addr, query_count) = spawn_slow_dns_server(Duration::from_millis(200)).await;
-        let ctx = test_recursive_ctx(server_addr).await;
-        let src: SocketAddr = "127.0.0.1:9999".parse().unwrap();
-
-        // Fire 5 concurrent queries for the same (domain, A)
         let mut handles = Vec::new();
         for i in 0..5u16 {
-            let ctx = ctx.clone();
-            let buf = build_wire_query(100 + i, "coalesce-test.example.com", QueryType::A);
-            handles.push(tokio::spawn(
-                async move { handle_query(buf, src, &ctx).await },
-            ));
+            let count = resolve_count.clone();
+            let inf = inflight.clone();
+            let key = ("coalesce.test".to_string(), QueryType::A);
+            let query = DnsPacket::query(100 + i, "coalesce.test", QueryType::A);
+            handles.push(tokio::spawn(async move {
+                resolve_coalesced(&inf, key, &query, || async {
+                    count.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+                    tokio::time::sleep(Duration::from_millis(200)).await;
+                    Ok(mock_response("coalesce.test"))
+                })
+                .await
+            }));
         }
 
+        let mut paths = Vec::new();
         for h in handles {
-            h.await.unwrap().unwrap();
+            let (_, path, _) = h.await.unwrap();
+            paths.push(path);
         }
 
-        // Only 1 resolution should have reached the upstream server
-        let actual = query_count.load(std::sync::atomic::Ordering::Relaxed);
-        assert_eq!(actual, 1, "expected 1 upstream query, got {}", actual);
+        let actual = resolve_count.load(std::sync::atomic::Ordering::Relaxed);
+        assert_eq!(actual, 1, "expected 1 resolution, got {}", actual);
 
-        // Inflight map must be empty after all queries complete
-        assert!(ctx.inflight.lock().unwrap().is_empty());
+        let recursive = paths.iter().filter(|p| **p == QueryPath::Recursive).count();
+        let coalesced = paths.iter().filter(|p| **p == QueryPath::Coalesced).count();
+        assert_eq!(recursive, 1, "expected 1 RECURSIVE, got {}", recursive);
+        assert_eq!(coalesced, 4, "expected 4 COALESCED, got {}", coalesced);
 
-        crate::recursive::reset_udp_state();
+        assert!(inflight.lock().unwrap().is_empty());
     }
 
     #[tokio::test]
     async fn different_qtypes_not_coalesced() {
-        crate::recursive::UDP_DISABLED.store(true, std::sync::atomic::Ordering::Release);
+        let inflight = Arc::new(Mutex::new(HashMap::new()));
+        let resolve_count = Arc::new(std::sync::atomic::AtomicU32::new(0));
 
-        let (server_addr, query_count) = spawn_slow_dns_server(Duration::from_millis(100)).await;
-        let ctx = test_recursive_ctx(server_addr).await;
-        let src: SocketAddr = "127.0.0.1:9999".parse().unwrap();
+        let inf1 = inflight.clone();
+        let inf2 = inflight.clone();
+        let count1 = resolve_count.clone();
+        let count2 = resolve_count.clone();
 
-        // Fire A and AAAA concurrently — should NOT coalesce
-        let ctx_ref = ctx.clone();
-        let ctx_ref2 = ctx.clone();
-        let buf_a = build_wire_query(200, "different-qt.example.com", QueryType::A);
-        let buf_aaaa = build_wire_query(201, "different-qt.example.com", QueryType::AAAA);
+        let query_a = DnsPacket::query(200, "same.domain", QueryType::A);
+        let query_aaaa = DnsPacket::query(201, "same.domain", QueryType::AAAA);
 
-        let h1 = tokio::spawn(async move { handle_query(buf_a, src, &ctx_ref).await });
-        let h2 = tokio::spawn(async move { handle_query(buf_aaaa, src, &ctx_ref2).await });
+        let h1 = tokio::spawn(async move {
+            resolve_coalesced(
+                &inf1,
+                ("same.domain".to_string(), QueryType::A),
+                &query_a,
+                || async {
+                    count1.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+                    tokio::time::sleep(Duration::from_millis(100)).await;
+                    Ok(mock_response("same.domain"))
+                },
+            )
+            .await
+        });
+        let h2 = tokio::spawn(async move {
+            resolve_coalesced(
+                &inf2,
+                ("same.domain".to_string(), QueryType::AAAA),
+                &query_aaaa,
+                || async {
+                    count2.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+                    tokio::time::sleep(Duration::from_millis(100)).await;
+                    Ok(mock_response("same.domain"))
+                },
+            )
+            .await
+        });
 
-        h1.await.unwrap().unwrap();
-        h2.await.unwrap().unwrap();
+        let (_, path1, _) = h1.await.unwrap();
+        let (_, path2, _) = h2.await.unwrap();
 
-        let actual = query_count.load(std::sync::atomic::Ordering::Relaxed);
-        assert!(
-            actual >= 2,
-            "A and AAAA should resolve independently, got {}",
-            actual
-        );
-        assert!(ctx.inflight.lock().unwrap().is_empty());
+        let actual = resolve_count.load(std::sync::atomic::Ordering::Relaxed);
+        assert_eq!(actual, 2, "A and AAAA should each resolve, got {}", actual);
+        assert_eq!(path1, QueryPath::Recursive);
+        assert_eq!(path2, QueryPath::Recursive);
 
-        crate::recursive::reset_udp_state();
+        assert!(inflight.lock().unwrap().is_empty());
     }
 
     #[tokio::test]
-    async fn inflight_map_cleaned_after_upstream_error() {
-        // Server that rejects everything — no server running at all
-        let bogus_addr: SocketAddr = "127.0.0.1:1".parse().unwrap();
-        let ctx = test_recursive_ctx(bogus_addr).await;
-        let src: SocketAddr = "127.0.0.1:9999".parse().unwrap();
+    async fn inflight_map_cleaned_after_error() {
+        let inflight: Mutex<InflightMap> = Mutex::new(HashMap::new());
+        let query = DnsPacket::query(300, "will-fail.test", QueryType::A);
 
-        let buf = build_wire_query(300, "will-fail.example.com", QueryType::A);
-        let _ = handle_query(buf, src, &ctx).await;
+        let (_, path, _) = resolve_coalesced(
+            &inflight,
+            ("will-fail.test".to_string(), QueryType::A),
+            &query,
+            || async { Err::<DnsPacket, _>("upstream timeout".into()) },
+        )
+        .await;
 
-        // Map must be clean even after error
-        assert!(ctx.inflight.lock().unwrap().is_empty());
+        assert_eq!(path, QueryPath::UpstreamError);
+        assert!(inflight.lock().unwrap().is_empty());
+    }
+
+    #[tokio::test]
+    async fn follower_gets_servfail_when_leader_fails() {
+        let inflight = Arc::new(Mutex::new(HashMap::new()));
+
+        let mut handles = Vec::new();
+        for i in 0..3u16 {
+            let inf = inflight.clone();
+            let query = DnsPacket::query(400 + i, "fail.test", QueryType::A);
+            handles.push(tokio::spawn(async move {
+                resolve_coalesced(
+                    &inf,
+                    ("fail.test".to_string(), QueryType::A),
+                    &query,
+                    || async {
+                        tokio::time::sleep(Duration::from_millis(200)).await;
+                        Err::<DnsPacket, _>("upstream error".into())
+                    },
+                )
+                .await
+            }));
+        }
+
+        let mut paths = Vec::new();
+        for h in handles {
+            let (resp, path, _) = h.await.unwrap();
+            assert_eq!(resp.header.rescode, ResultCode::SERVFAIL);
+            assert_eq!(
+                resp.questions.len(),
+                1,
+                "SERVFAIL must echo question section"
+            );
+            assert_eq!(resp.questions[0].name, "fail.test");
+            paths.push(path);
+        }
+
+        let errors = paths
+            .iter()
+            .filter(|p| **p == QueryPath::UpstreamError)
+            .count();
+        assert_eq!(errors, 3, "all 3 should be UpstreamError, got {}", errors);
+
+        assert!(inflight.lock().unwrap().is_empty());
+    }
+
+    #[tokio::test]
+    async fn servfail_leader_includes_question_section() {
+        let inflight: Mutex<InflightMap> = Mutex::new(HashMap::new());
+        let query = DnsPacket::query(500, "question.test", QueryType::A);
+
+        let (resp, _, _) = resolve_coalesced(
+            &inflight,
+            ("question.test".to_string(), QueryType::A),
+            &query,
+            || async { Err::<DnsPacket, _>("fail".into()) },
+        )
+        .await;
+
+        assert_eq!(resp.header.rescode, ResultCode::SERVFAIL);
+        assert_eq!(
+            resp.questions.len(),
+            1,
+            "SERVFAIL must echo question section"
+        );
+        assert_eq!(resp.questions[0].name, "question.test");
+        assert_eq!(resp.questions[0].qtype, QueryType::A);
+        assert_eq!(resp.header.id, 500);
+    }
+
+    #[tokio::test]
+    async fn leader_error_preserves_message() {
+        let inflight: Mutex<InflightMap> = Mutex::new(HashMap::new());
+        let query = DnsPacket::query(700, "err-msg.test", QueryType::A);
+
+        let (_, path, err) = resolve_coalesced(
+            &inflight,
+            ("err-msg.test".to_string(), QueryType::A),
+            &query,
+            || async { Err::<DnsPacket, _>("connection refused by upstream".into()) },
+        )
+        .await;
+
+        assert_eq!(path, QueryPath::UpstreamError);
+        assert_eq!(
+            err.as_deref(),
+            Some("connection refused by upstream"),
+            "error message must be preserved for logging"
+        );
     }
 }

src/forward.rs

@@ -141,7 +141,7 @@ mod tests {
     use std::future::IntoFuture;
 
     use crate::header::ResultCode;
-    use crate::question::{DnsQuestion, QueryType};
+    use crate::question::QueryType;
     use crate::record::DnsRecord;
 
     #[test]
@@ -160,12 +160,7 @@ mod tests {
     }
 
     fn make_query() -> DnsPacket {
-        let mut q = DnsPacket::new();
-        q.header.id = 0xABCD;
-        q.header.recursion_desired = true;
-        q.questions
-            .push(DnsQuestion::new("example.com".to_string(), QueryType::A));
-        q
+        DnsPacket::query(0xABCD, "example.com", QueryType::A)
     }
 
     fn make_response(query: &DnsPacket) -> DnsPacket {

src/main.rs

@@ -208,7 +208,6 @@ async fn main() -> numa::Result<()> {
     });
 
     let zone_count: usize = ctx.zone_map.values().map(|m| m.len()).sum();
-
     // Build banner rows, then size the box to fit the longest value
     let api_url = format!("http://localhost:{}", api_port);
     let proxy_label = if config.proxy.enabled {
@@ -308,6 +307,17 @@ async fn main() -> numa::Result<()> {
     );
     if let Some(ref label) = proxy_label {
         row("Proxy", g, label);
+        if config.proxy.bind_addr == "127.0.0.1" {
+            let y = "\x1b[38;2;204;176;59m"; // yellow
+            row(
+                "",
+                y,
+                &format!(
+                    "⚠ proxy on 127.0.0.1 — .{} not LAN reachable",
+                    config.proxy.tld
+                ),
+            );
+        }
     }
     if config.lan.enabled {
         row("LAN", g, "mDNS (_numa._tcp.local)");
@@ -375,16 +385,11 @@ async fn main() -> numa::Result<()> {
         axum::serve(listener, app).await.unwrap();
     });
 
-    // Proxy binds 0.0.0.0 when LAN is enabled (cross-machine access), otherwise config value
-    let proxy_bind: std::net::Ipv4Addr = if config.lan.enabled {
-        std::net::Ipv4Addr::UNSPECIFIED
-    } else {
-        config
-            .proxy
-            .bind_addr
-            .parse()
-            .unwrap_or(std::net::Ipv4Addr::LOCALHOST)
-    };
+    let proxy_bind: std::net::Ipv4Addr = config
+        .proxy
+        .bind_addr
+        .parse()
+        .unwrap_or(std::net::Ipv4Addr::LOCALHOST);
 
     // Spawn HTTP reverse proxy for .numa domains
     if config.proxy.enabled {

src/packet.rs

@@ -57,6 +57,15 @@ impl DnsPacket {
         }
     }
 
+    pub fn query(id: u16, domain: &str, qtype: crate::question::QueryType) -> DnsPacket {
+        let mut pkt = DnsPacket::new();
+        pkt.header.id = id;
+        pkt.header.recursion_desired = true;
+        pkt.questions
+            .push(crate::question::DnsQuestion::new(domain.to_string(), qtype));
+        pkt
+    }
+
     pub fn response_from(query: &DnsPacket, rescode: crate::header::ResultCode) -> DnsPacket {
         let mut resp = DnsPacket::new();
         resp.header.id = query.header.id;

src/recursive.rs

@@ -9,7 +9,7 @@ use crate::cache::DnsCache;
 use crate::forward::forward_udp;
 use crate::header::ResultCode;
 use crate::packet::DnsPacket;
-use crate::question::{DnsQuestion, QueryType};
+use crate::question::QueryType;
 use crate::record::DnsRecord;
 use crate::srtt::SrttCache;
 
@@ -32,6 +32,14 @@ fn dns_addr(ip: impl Into<IpAddr>) -> SocketAddr {
     SocketAddr::new(ip.into(), 53)
 }
 
+fn record_to_addr(rec: &DnsRecord) -> Option<SocketAddr> {
+    match rec {
+        DnsRecord::A { addr, .. } => Some(dns_addr(*addr)),
+        DnsRecord::AAAA { addr, .. } => Some(dns_addr(*addr)),
+        _ => None,
+    }
+}
+
 pub fn reset_udp_state() {
     UDP_DISABLED.store(false, Ordering::Release);
     UDP_FAILURES.store(0, Ordering::Release);
@@ -46,11 +54,8 @@ pub async fn probe_udp(root_hints: &[SocketAddr]) {
         Some(h) => *h,
         None => return,
     };
-    let mut probe = DnsPacket::new();
-    probe.header.id = next_id();
-    probe
-        .questions
-        .push(DnsQuestion::new(".".to_string(), QueryType::NS));
+    let mut probe = DnsPacket::query(next_id(), ".", QueryType::NS);
+    probe.header.recursion_desired = false;
     if forward_udp(&probe, hint, Duration::from_millis(1500))
         .await
         .is_ok()
@@ -296,17 +301,8 @@ pub(crate) fn resolve_iterative<'a>(
                             )
                             .await
                             {
-                                for rec in &ns_resp.answers {
-                                    match rec {
-                                        DnsRecord::A { addr, .. } => {
-                                            new_ns_addrs.push(dns_addr(*addr));
-                                        }
-                                        DnsRecord::AAAA { addr, .. } => {
-                                            new_ns_addrs.push(dns_addr(*addr));
-                                        }
-                                        _ => {}
-                                    }
-                                }
+                                new_ns_addrs
+                                    .extend(ns_resp.answers.iter().filter_map(record_to_addr));
                             }
                             if !new_ns_addrs.is_empty() {
                                 break;
@@ -360,13 +356,7 @@ fn find_closest_ns(
                 if let DnsRecord::NS { host, .. } = ns_rec {
                     for qt in [QueryType::A, QueryType::AAAA] {
                         if let Some(resp) = guard.lookup(host, qt) {
-                            for rec in &resp.answers {
-                                match rec {
-                                    DnsRecord::A { addr, .. } => addrs.push(dns_addr(*addr)),
-                                    DnsRecord::AAAA { addr, .. } => addrs.push(dns_addr(*addr)),
-                                    _ => {}
-                                }
-                            }
+                            addrs.extend(resp.answers.iter().filter_map(record_to_addr));
                         }
                     }
                 }
@@ -452,13 +442,7 @@ fn addrs_from_cache(cache: &RwLock<DnsCache>, name: &str) -> Vec<SocketAddr> {
     let mut addrs = Vec::new();
     for qt in [QueryType::A, QueryType::AAAA] {
         if let Some(pkt) = guard.lookup(name, qt) {
-            for rec in &pkt.answers {
-                match rec {
-                    DnsRecord::A { addr, .. } => addrs.push(dns_addr(*addr)),
-                    DnsRecord::AAAA { addr, .. } => addrs.push(dns_addr(*addr)),
-                    _ => {}
-                }
-            }
+            addrs.extend(pkt.answers.iter().filter_map(record_to_addr));
         }
     }
     addrs
@@ -468,15 +452,13 @@ fn glue_addrs_for(response: &DnsPacket, ns_name: &str) -> Vec<SocketAddr> {
     response
         .resources
         .iter()
-        .filter_map(|r| match r {
-            DnsRecord::A { domain, addr, .. } if domain.eq_ignore_ascii_case(ns_name) => {
-                Some(dns_addr(*addr))
+        .filter(|r| match r {
+            DnsRecord::A { domain, .. } | DnsRecord::AAAA { domain, .. } => {
+                domain.eq_ignore_ascii_case(ns_name)
             }
-            DnsRecord::AAAA { domain, addr, .. } if domain.eq_ignore_ascii_case(ns_name) => {
-                Some(dns_addr(*addr))
-            }
-            _ => None,
+            _ => false,
         })
+        .filter_map(record_to_addr)
         .collect()
 }
 
@@ -596,12 +578,8 @@ async fn send_query(
     server: SocketAddr,
     srtt: &RwLock<SrttCache>,
 ) -> crate::Result<DnsPacket> {
-    let mut query = DnsPacket::new();
-    query.header.id = next_id();
+    let mut query = DnsPacket::query(next_id(), qname, qtype);
     query.header.recursion_desired = false;
-    query
-        .questions
-        .push(DnsQuestion::new(qname.to_string(), qtype));
     query.edns = Some(crate::packet::EdnsOpt {
         do_bit: true,
         ..Default::default()
@@ -1056,11 +1034,7 @@ mod tests {
         })
         .await;
 
-        let mut query = DnsPacket::new();
-        query.header.id = 0xBEEF;
-        query
-            .questions
-            .push(DnsQuestion::new("test.com".to_string(), QueryType::A));
+        let query = DnsPacket::query(0xBEEF, "test.com", QueryType::A);
 
         let resp = crate::forward::forward_tcp(&query, server_addr, Duration::from_secs(2))
             .await
@@ -1120,11 +1094,7 @@ mod tests {
                 .unwrap();
         });
 
-        let mut query = DnsPacket::new();
-        query.header.id = 0xCAFE;
-        query
-            .questions
-            .push(DnsQuestion::new("strict.test".to_string(), QueryType::A));
+        let query = DnsPacket::query(0xCAFE, "strict.test", QueryType::A);
 
         let resp = crate::forward::forward_tcp(&query, addr, Duration::from_secs(2))
             .await

src/stats.rs

@@ -13,7 +13,7 @@ pub struct ServerStats {
     started_at: Instant,
 }
 
-#[derive(Clone, Copy, PartialEq, Eq)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum QueryPath {
     Local,
     Cached,